c05fa14db4
When vmci_transport_recv_connecting_server() returns an error,
vmci_transport_recv_listen() calls vsock_remove_pending() but never
calls sk_acceptq_removed(). This leaves sk_ack_backlog incremented
permanently.
Repeated handshake failures (malformed packets, queue pair alloc
failure, event subscribe failure) cause sk_ack_backlog to climb
toward sk_max_ack_backlog. Once it reaches the limit the listener
permanently refuses all new connections with -ECONNREFUSED, a
silent denial of service requiring a process restart to recover.
The two existing sk_acceptq_removed() calls in af_vsock.c do not
cover this path: line 764 checks vsock_is_pending() which returns
false after vsock_remove_pending(), and line 1889 is only reached
on successful accept().
Fix by balancing sk_acceptq_added() with sk_acceptq_removed() on
the error path.
Fixes:
|
||
|---|---|---|
| .. | ||
| af_vsock.c | ||
| af_vsock_tap.c | ||
| diag.c | ||
| hyperv_transport.c | ||
| Kconfig | ||
| Makefile | ||
| virtio_transport.c | ||
| virtio_transport_common.c | ||
| vmci_transport.c | ||
| vmci_transport.h | ||
| vmci_transport_notify.c | ||
| vmci_transport_notify.h | ||
| vmci_transport_notify_qstate.c | ||
| vsock_addr.c | ||
| vsock_bpf.c | ||
| vsock_loopback.c | ||